Connect with us
DAPA Banner

Crypto World

Volo Protocol Security Breach: $3.5M Drained From Sui-Based Liquid Staking Platform

Published

on

Brian Armstrong's Bold Prediction: AI Agents Will Soon Dominate Global Financial

Key Highlights

  • A security breach at Volo Protocol, a liquid staking service on Sui, resulted in approximately $3.5 million in stolen funds
  • Three separate vaults containing WBTC, XAUm, and USDC were compromised in the incident
  • Within half an hour of disclosure, Volo managed to freeze $500,000 worth of stolen assets
  • The protocol’s other vaults, holding $28 million in total value locked, remain secure
  • The development team has committed to covering all losses without impacting users

On April 21, Volo Protocol—a liquid staking service operating on the Sui blockchain—disclosed that it had fallen victim to a security exploit resulting in roughly $3.5 million in stolen user funds.

The breach impacted three specific vaults within the protocol’s infrastructure. These vaults contained Wrapped Bitcoin, a gold-pegged asset known as XAUm, and USDC stablecoin. No other vaults within the platform were compromised.

The team behind Volo revealed the incident via X, explaining that they immediately reached out to the Sui Foundation and ecosystem collaborators upon detecting the breach. As a precautionary measure, all vaults were frozen to prevent additional fund drainage.

Remarkably, just 30 minutes after making the exploit public, Volo reported successfully freezing $500,000 of the misappropriated assets. The specific mechanism used to accomplish this freeze was not disclosed.

According to Volo’s statement, the $28 million in assets held across its remaining vaults faces no exposure to risk. The team clarified that these unaffected vaults operate independently and do not contain the same security flaw.

Advertisement

Team Commits to Full User Reimbursement

The Volo development team announced it would shoulder the entire financial burden of the exploit rather than passing any costs to its user base. “We want to be clear: Volo is prepared to absorb this loss,” the team stated on X.

Details regarding the specific security vulnerability exploited in the attack have not been made public. Similarly, the perpetrator’s identity remains unknown.

Volo confirmed that all vaults will remain in a frozen state until investigators complete a comprehensive post-mortem analysis and establish a proper remediation strategy. The team has enlisted on-chain forensic experts to assist in tracking and potentially recovering the outstanding stolen funds.

Emphasizing their commitment to the community, the protocol stated: “We understand that trust is earned, and right now, we are focused entirely on actions,” according to Volo’s public statement.

Latest in a Series of DeFi Security Incidents

This security breach at Volo comes on the heels of a significantly larger exploit targeting Kelp DAO, a LayerZero-powered cross-chain bridge that suffered a devastating $292 million loss in a separate attack.

Security researchers have attributed the Kelp DAO compromise to the Lazarus Group, a North Korean state-sponsored cyber operation with an established history of attacking cryptocurrency infrastructure.

Advertisement

Volo’s team has made no indication that their exploit shares any connection with the Kelp DAO breach.

No specific timeline has been provided for when the frozen vaults will resume normal operations. A detailed post-mortem analysis is anticipated following the completion of the ongoing investigation.

As of now, the $500,000 in frozen assets represents the only confirmed portion of the stolen funds that has been secured.

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Crypto Firms Report Flood of AI-Driven Bug Bounty Submissions

Published

on

Crypto Firms Report Flood of AI-Driven Bug Bounty Submissions

Crypto protocols have warned that an increase in AI use has led to a flood of bogus bug bounty submissions, putting a strain on teams trying to identify real threats to their protocols. 

Bug bounties are a system to reward “good” hackers for submitting reports about potential vulnerabilities and are popular in the crypto industry. AI has now made it easier to sift through large amounts of code to find possible bugs, though AI is also known to hallucinate

“AI is changing the way that bug bounty programs must operate,” said Barry Plunkett, co-CEO of Cosmos Labs, on Tuesday, responding to a bug bounty hunter who accused the protocol of ignoring their vulnerability report. 

Source: Barry Plunkett

“Our program has seen a 900% increase in submission volume from last year, on the order of 20-50 per day,” he said, adding that it’s led to a huge increase in both valid and invalid reports. 

Kadan Stadelmann, a blockchain developer and chief technology officer at Komodo Platform, told Cointelegraph he has also seen a notable increase in bug bounty submissions and payouts across organizations. 

Advertisement

“There has definitely been an increase in low-quality bug bounty submissions, some of which have been false positives, potentially suggesting AI sourcing. One potential explanation is that AI has caused a decrease in the cost to produce a report, resulting in an influx of submissions.” 

In January, Daniel Stenberg, the creator of the open-source data transfer tool curl, which is used in many apps, including blockchain infrastructure, announced he was ending his bug bounty program because of an influx of “AI slop in vulnerability reports,” and he was exhausted from sifting through them.

The creator of the open-source data transfer tool curl said he has received an influx of bug bounty submissions. Source: Daniel Stenberg

HackerOne, one of the largest bug bounty platforms in the world, reported in January that there were 85,000 valid bounty submissions in 2025, up 7% from the previous year.

AI could be both the cause and the solution

Plunkett said Cosmos Labs has already started to adapt its approach as a result of the uptick in bug bounty submissions by tightening how it scores submissions, prioritizing trusted researchers with a proven track record and working with other bug bounty providers that offer more advanced triage.

Meanwhile, Stadelmann said bug bounty programs have proven integral to defending decentralized systems, and adopting AI to assist in sifting through the noise could be a solution.

“Blockchain teams will have to create AI deterrents to sift through incoming bug bounties. The smaller the team, the bigger the problem of increased bug bounties will become. Software engineers won’t have the capacity to examine everything,” he said.

Advertisement

“This is where defensive AI systems to automatically sift through incoming bug bounties will be crucial. Teams dependent on bug bounties will need to develop stricter standards on their bug bounty programs as a means of lowering the number of incoming reports.”

Related: Crypto hackers stole $17B over past 10 years: DefiLlama